How do I vet an AI tool before employees use it?

By Hugh Donatello, LAN Service Group · Published October 20, 2026 · Updated October 20, 2026

✓ Vendor terms checked on October 20, 2026 against OpenAI's enterprise privacy, plan comparison, data processing addendum, sub-processor, services agreement and HIPAA guide pages; Anthropic's commercial terms, privacy center and Claude plans pages; Microsoft's Copilot audit log page; and Google Workspace's Data Regions page. No prices are stated on this page.

Short answer

Check the vendor's own terms for the exact plan you will buy, against 12 questions: training use, retention, deletion, admin controls, sign-in (SSO and MFA), audit logs, data location, sub-processors, terms-change notice, contract terms, security evidence and breach notification. Treat training, deletion and admin controls as must-pass. CIO Support's free Excel sheet scores each tool and fills a row for your approved-tools register.

Free AI tool vetting checklist (scored)

Rate a tool on 12 questions from the vendor's own terms, record the quote, link and date for each, and the sheet works out a score out of 24, applies three gate questions and recommends Approve, Approve with limits, Find out first or Not approved. A Register row tab matches the approved-tools register's columns. No form or sign-up. General guidance, not legal advice.

Download Excel (.xlsx)

Free AI acceptable-use policy template and approved-tools register

Editable Word document and PDF, plus an Excel register of approved AI tools. No form or sign-up. Fill in the bracketed fields and have your own legal and HR advisers review the policy before you adopt it. What the template covers →

Download Word (.docx) Download PDF Download approved-tools register (.xlsx)

Why vet a tool before anyone uses it

In many small businesses AI tools arrive the other way round: someone finds a useful one, signs up with a work email, and starts pasting in customer emails, contracts or spreadsheets. That is shadow AI. In CIO Support's view, blocking every tool is hard to sustain; the better answer is a short, repeatable check that turns a request into a yes, a yes with limits, or a no, and records why.

The check is about the vendor's terms, not the tool's features. What matters is what happens to the data your staff put in: whether it trains the vendor's models, how long it is kept, who else processes it, where it is stored, whether you can delete it and whether you will be told when any of that changes. NIST's AI Risk Management Framework asks for policies and procedures that address AI risks associated with third-party entities (GOVERN 6.1), and the NIST Cybersecurity Framework 2.0 asks that planning and due diligence are performed to reduce risks before entering into formal supplier relationships (GV.SC-06). For a company of ten to two hundred people, a 12-question checklist done from the vendor's public pages is a practical starting point for the due diligence both describe. It is not itself a policy, and it does not cover every third-party risk GOVERN 6.1 names, such as infringement of intellectual property or other rights in what a tool produces.

This checklist is written for general business tools: chat assistants, meeting note-takers, writing aids, AI features inside software you already use. It is not a life-science or GxP vendor questionnaire, and it does not replace legal review of a contract.

The 12 questions, and what a good answer looks like

Answer each question from the vendor's own pages for the plan you will actually buy, and write down the link and the date you read it. Each question is tied to a published framework outcome, and the right-hand column shows what one real vendor's terms said when CIO Support read them on October 20, 2026. Those examples show what to look for; they are not a rating of any vendor, and terms change.

AI tool vetting checklist: 12 questions, framework references and vendor-terms examples (vendor pages checked 2026-10-20)
Question	Ask	A good answer	Framework it ties to	Vendor-terms example	Source
1. Training use (gate)	On the plan you will buy, are your inputs and outputs kept out of model training by default?	Yes, by default, in the terms or data-use page for that plan, with any exceptions (such as feedback you submit) named.	NIST AI RMF 1.0 GOVERN 6.1 (third-party AI risks); NIST CSF 2.0 GV.SC-06 (due diligence before a supplier relationship).	OpenAI: 'By default, data from ChatGPT Business, ChatGPT Enterprise ... and the API Platform (after March 1, 2023) isn't used for training our models, unless you have explicitly opted in to share your data with us to improve the services.' Anthropic: 'By default, we will not use your inputs or outputs from our commercial products ... to train our models'; feedback or bug reports a user submits, for example with the thumbs up/down button, or data the customer otherwise chooses to share, may be used, and a Team or Enterprise Owner can turn that button off with the Rate chats setting.	[12] [11] [1] [7]
2. Retention	Do you know how long your prompts, files and outputs are kept, and can an admin set that period?	A stated retention period, an admin setting to shorten it, and a stated window for removing deleted data.	NIST CSF 2.0 GV.SC-05 (cybersecurity requirements in supplier contracts).	OpenAI (ChatGPT Business): 'Your workspace admins can control how long your data is retained. Any deleted or unsaved conversations are removed from our systems within 30 days', with legal and safety exceptions; the same page's commitments list names only Enterprise, Healthcare and Edu for retention control, so confirm for Business. Anthropic's pricing table shows custom data retention controls on Enterprise, not Team.	[11] [1] [8]
3. Deletion (gate)	Can you delete your data on request, and will the vendor return or delete it when the contract ends?	Users or admins can delete content, and the contract or data processing addendum (DPA) commits to return or deletion at termination.	NIST CSF 2.0 GV.SC-10 (plans cover what happens after a supplier agreement ends).	OpenAI Services Agreement section 11.3: if the agreement terminates, 'OpenAI will delete all Customer Content from its systems within thirty days', unless OpenAI is legally required to retain it or the customer has agreed otherwise in writing. Its DPA (section 2.11) adds a right to have personal data returned or deleted at the customer's instruction.	[11] [5] [3]
4. Admin controls (gate)	Can the company own the accounts: add and remove users centrally, and switch features and connectors on or off?	A company workspace with an admin console, user removal, and controls over connectors, plug-ins and sharing.	NIST CSF 2.0 PR.AA-05 (access permissions managed, enforced and reviewed, with least privilege).	OpenAI's pricing table lists 'Admin console' and 'Bulk member management' for ChatGPT Business. Anthropic's lists 'Admin controls for remote and local connectors' for Team and Enterprise.	[11] [2] [8]
5. Sign-in (SSO and MFA)	Does the plan support single sign-on (SSO) with your identity provider, or at least enforce multi-factor authentication (MFA)?	SSO (for example SAML) on the plan you are buying, so leavers lose access when their company account is disabled.	NIST CSF 2.0 PR.AA-01 (identities and credentials managed by the organization); CISA Secure by Demand guide: SSO 'at no additional cost'.	Anthropic's pricing table shows 'Single sign-on (SSO) and domain capture' as No on Free, Pro and Max, and SSO as Yes on Team and Enterprise. OpenAI's lists SAML SSO for ChatGPT Business and Enterprise.	[11] [13] [8] [2]
6. Audit logs	Can an admin see who used the tool and export activity logs?	User and admin activity logs on your plan, kept for months, exportable or reachable by API.	NIST CSF 2.0 PR.PS-04 (log records generated and available for monitoring); CISA Secure by Demand guide: security logs for at least six months at no additional charge for SaaS.	Anthropic's pricing table shows audit logs as No on Team and Yes on Enterprise. Microsoft says Copilot user interactions and admin activities are logged automatically as part of Purview Audit (Standard) when auditing is turned on for the organization.	[11] [13] [8] [9]
7. Data location	Do you know where your data is stored and processed, and can you choose the region if a customer or law requires it?	Stated storage regions, and a region setting on your plan if your contracts require one.	NIST CSF 2.0 GV.OC-03 (legal, regulatory and contractual requirements, including privacy, understood and managed).	OpenAI's pricing table shows data residency in ten regions as No on ChatGPT Business and Yes on Enterprise. Google includes Fundamental Data Regions (covered data stored in the United States or Europe) at no additional cost on editions including Business Standard and Business Plus, and lists which services and data types it covers.	[11] [2] [10]
8. Sub-processors	Does the vendor publish the other companies that process your data, and tell you before it adds one?	A published sub-processor list, a way to get notice of changes, and a right to object.	NIST CSF 2.0 GV.SC-07 (supplier risks understood and monitored over the relationship).	OpenAI DPA: 'OpenAI will notify Customer of any changes to the Sub-Processor List via blog post, notification within the Services or other reasonable means', or by email for subscribers, and the customer 'may object ... within 30 days'.	[11] [3] [4]
9. Terms-change notice	If the vendor changes its terms, how much notice do you get, and how?	A stated notice period (for example 30 days) before changes take effect, and a way to be told rather than having to check.	NIST CSF 2.0 GV.SC-07 (monitored over the course of the relationship); GV.SC-05 (requirements in contracts).	Anthropic Commercial Terms: updates take effect '30 days after the updates are posted by Anthropic or Customer otherwise receives Notice', except that updates made in response to changes to law or regulation take effect immediately. OpenAI Services Agreement: updates that OpenAI determines materially impact the customer's rights or obligations get 'at least thirty days' notice' (less where needed to comply with law); 'Any other updates will be effective on the date OpenAI posts' them.	[11] [6] [5]
10. Contract terms	Is there a data processing addendum (DPA), and, if the tool will touch protected health information, a business associate agreement (BAA)?	A DPA that applies to your plan; a signed BAA before any protected health information goes in, where HIPAA applies. If HIPAA applies and no BAA covers this plan, rate Q10 No and keep protected health information out of the tool at any data level.	NIST CSF 2.0 GV.SC-05 (requirements in contracts); HIPAA, 45 CFR 164.502(e) (satisfactory assurance from a business associate).	OpenAI publishes a Data Processing Addendum. Its HIPAA guide (July 9, 2026) names ChatGPT for Healthcare, ChatGPT for Clinicians, ChatGPT Enterprise / Education with the Regulated Workspace, or another ChatGPT service the BAA identifies as eligible, and says 'ChatGPT services for consumers (e.g., Free, Plus, Pro) and ChatGPT Business are not Eligible Services.' Anthropic's pricing table shows a HIPAA-ready offering as No on Team and available on Enterprise.	[11] [14] [3] [15] [8]
11. Security evidence	Can the vendor show independent evidence of its security, such as a SOC 2 Type 2 report or ISO/IEC 27001 certificate?	A current report or certificate covering the product you are buying, available from a trust portal.	NIST CSF 2.0 GV.SC-06 (due diligence before entering a supplier relationship); CISA Secure by Demand guide (questions to ask before procurement).	OpenAI: 'ChatGPT Business successfully completed a SOC 2 Type 2 audit.'	[11] [13] [1]
12. Breach notification	Will the vendor tell you if your data is involved in a breach, and how fast?	A contract commitment to notify you without undue delay, or within a stated time, with the details you need.	NIST CSF 2.0 GV.SC-08 (suppliers included in incident planning, response and recovery).	OpenAI DPA: 'OpenAI will notify Customer without undue delay after becoming aware of any Personal Data Breach'. In that DPA, Customer Data 'means Personal Data processed by OpenAI on behalf of Customer', so the commitment covers personal data; for other business content, look for a security-incident term in the vendor's security measures or order form, or ask.	[11] [3]

Framework wording is quoted or closely paraphrased from NIST CSWP 29 (CSF 2.0), NIST AI 100-1, CISA's Secure by Demand guide and 45 CFR 164.502(e). Vendor examples are quoted or closely paraphrased from each vendor's page, read on October 20, 2026. The choice of questions and the gate are CIO Support's, not a NIST or CISA list.

Where to find the answers

Start with four kinds of vendor page; it is quicker to open them once than to search for each question. The plan comparison table, usually on the pricing page, answers sign-in, admin controls, audit logs, retention settings and data residency for each plan. The privacy or data-use page for business customers answers training use and retention, and often names a security report. The data processing addendum (DPA) answers sub-processors and what happens to personal data, including breach notification and return or deletion. The terms of service or commercial terms answer how the vendor may change those terms and, often, what happens to all your content when the contract ends. Check what each term covers: a DPA commitment may apply only to personal data. Many vendors also run a trust or security portal where you can request a SOC 2 report.

Read the date or version on each page, and paste the quote, not your summary of it, into the Evidence tab. A quote lets the next reviewer see in a minute whether the terms have moved. If two of the vendor's pages disagree, record both and rate the question Partly until the vendor confirms which applies to your plan. If a sales representative tells you something the published terms do not say, ask for it in writing or in the order form; a promise in an email is weaker than a term in the contract.

Why are training use, deletion and admin controls the gate? Because a high score elsewhere cannot make up for them. If inputs train the vendor's models, if you cannot get data back or deleted, or if the company cannot own the accounts and remove a leaver, the other controls protect data you no longer control.

Same vendor, different plan: why the plan matters

A common vetting mistake is reading the right vendor's terms for the wrong plan. Business and enterprise tiers of the same product often differ on exactly the questions above. CISA's Secure by Demand guide asks buyers to check whether a manufacturer includes basic security features, like logging and single sign-on (SSO), in the baseline version of the product. The table shows what two vendors' own plan comparison tables and privacy pages said on October 20, 2026.

What two vendors' plan tables and privacy pages said on October 20, 2026 (no prices shown; check the current page)
Question	ChatGPT Business	ChatGPT Enterprise	Claude Team	Claude Enterprise	Source
Q1 Training on your content by default	No	No	No	No	[2] [8]
Q5 Single sign-on (SSO)	Yes (SAML SSO)	Yes (SAML SSO)	Yes	Yes	[2] [8]
Q6 Audit or compliance logs	Compliance API Logs Platform: No	Compliance API Logs Platform: Yes	Audit logs: No	Audit logs: Yes	[2] [8]
Q2 Retention set by the company	Privacy FAQ: workspace admins can control retention; the same page's commitments list names only Enterprise, Healthcare and Edu, so confirm	Custom data retention policies	Custom data retention controls: No	Custom data retention controls: Yes	[1] [2] [8]
Q7 Choice of data region	Data residency (10 regions): No	Data residency (10 regions): Yes	Not in the plan table; ask the vendor	Not in the plan table; ask the vendor	[2] [8]
Q10 Health data (HIPAA)	Not eligible: OpenAI's HIPAA guide says ChatGPT Business is not an Eligible Service	Only with the Regulated Workspace (or another service the BAA names as eligible), under a signed BAA	HIPAA-ready offering: No	HIPAA-ready offering: available (ask how it is enabled under a BAA)	[15] [8]

Read from OpenAI's ChatGPT business plan comparison, enterprise privacy page and HIPAA guide (dated July 9, 2026) and Claude's plans and pricing page on October 20, 2026. 'Not in the plan table' means the comparison table did not list it, not that the feature does not exist. Vendors change plans and terms often; re-check before you rely on any row.

How to score a tool

A score is useful because it makes two tools, or two plans of the same tool, comparable, and because it forces someone to look for each answer instead of assuming it. The free Excel sheet uses the simple method below. The thresholds are CIO Support's suggestion for a small business, not a NIST or CISA scale, and you can change them on the sheet's Settings tab.

Pick the plan. Write down the tool, the vendor, the exact plan or edition, who asked for it, what they want to use it for and the most sensitive data level they want to put in it.
Answer each question from the vendor's pages. Rate each of the 12 questions Yes, Partly, No or Unknown, and record the quote, link and date on the Evidence tab. If you cannot find the answer, it is Unknown, not Yes.
Add up the score. Yes scores 2, Partly scores 1, No or Unknown scores 0, so a tool scores from 0 to 24.
Apply the gate. Training use (Q1), deletion (Q3) and admin controls (Q4) are gate questions, and all three must be Yes. A No on any of them means Not approved, whatever the score. Otherwise, unless the tool could not reach 14 even if every open answer turned out Yes (then it is Not approved), a Partly or Unknown on any of them, or three or more Unknowns in total, means Find out first: settle the answer, for example by turning training off for the whole company and confirming it in the terms, then re-rate it.
Read the recommendation. After the gate, a score under 14 is Not approved; so is a tool that could not reach 14 even if every Partly and Unknown answer turned out Yes, since finding out would not change the result. 20 or more is Approve, for the data level requested; for Confidential or Restricted data, contract terms (Q10) must also be Yes, and for Restricted data, security evidence (Q11) and breach notification (Q12) must be Yes too. Anything else is Approve with limits, which suggests Internal data at most until the gaps are closed.
Have the owner decide. The sheet recommends; a named business owner decides, records the decision and the date, and the tool goes into the approved-tools register with its status and a next review date.

Two worked examples

These are hypothetical tools, not real vendors, and they are the two example rows in the Excel sheet.

An AI meeting note-taker on a business plan, requested for Confidential meeting content: training off by default (Yes), retention stated but not settable on that plan (Partly), deletion and return at contract end (Yes), admin console (Yes), SSO (Yes), no audit logs (No), stated data regions (Yes), published sub-processor list with notice (Yes), terms changes posted with a short notice period (Partly), DPA in place (Yes), no security report found (Unknown) and a breach notification commitment (Yes). That is 8 Yes and 2 Partly, so 18 out of 24, with all three gate questions passed: Approve with limits, Internal data at most. Finding a SOC 2 Type 2 report would make it 20 and Approve for Confidential data.

A free AI browser extension, requested for rewriting customer emails: it trains on inputs by default with no company-wide switch (No), has no company accounts or admin console (No) and states no retention, deletion or storage location (Unknown). It fails the gate on training use and admin controls, so it is Not approved, whatever else it offers. The answer for the requester is the approved tool that does the same job.

From the checklist to your approved-tools register

Vetting only helps if the result is written where staff look. CIO Support's free AI acceptable-use policy template points to an approved-tools register, an Excel list of every approved AI tool with its approved uses, highest data level, account type, vendor-terms answers, owner, status and next review date. The vetting sheet's Register row tab lays out each vetted tool in the same 20 columns, in the same order, so you can copy the row and paste it as values into the register. Cells that still need a human decision, such as which connectors are allowed, are marked [Decide].

The register is the list; the acceptable-use policy is the rule that staff use only tools on it; and an AI governance policy says who owns those decisions and how often they are reviewed. Re-check each approved tool at least every quarter, whenever the vendor gives notice of a change to its terms or sub-processors, and whenever you move to a different plan, since the plan can change the answers.

What this checklist does not cover

It does not tell you whether a tool is any good at its job, and it does not replace reading the contract. If a tool will receive protected health information and you are a HIPAA covered entity or business associate, you generally need a business associate agreement before any goes in (45 CFR 164.502(e)); a high score is not a substitute. If you handle controlled unclassified information for defense contracts, or regulated quality records, the tool also has to fit that program's scope, and that is a separate assessment. The checklist and sheet are general guidance, not legal advice, and none of NIST, CISA or the vendors named publishes or endorses them.

Common follow-up questions

What are the most important questions to ask an AI vendor?

Start with three: does it train on our data by default on this plan, can we delete our data and get it back or deleted when we leave, and can the company own and control the accounts. CIO Support treats those as gate questions; a No on any of them means the tool is not approved for company data, whatever else it offers.

Is the AI tool vetting checklist free?

Yes. The Excel scoring sheet on this page needs no form, email or sign-up. It is general guidance, not legal advice.

Can I rely on a vendor's marketing page?

No. Use the vendor's terms, data processing addendum, privacy or data-use pages and plan comparison table for the plan you will buy, and record the link and the date you read them. A marketing page may describe features that only some plans include.

How often should we re-vet an approved AI tool?

At least quarterly, plus whenever the vendor gives notice of a change to its terms or sub-processors, and whenever you change plans. Anthropic and OpenAI, for example, both set out in their business terms how and when they may update those terms.

Can a personal AI account pass the checklist?

No, not for company work. A personal account fails the admin-controls gate (Q4) because the company cannot own it, see who uses it or remove a leaver, and personal plans are not covered by business data commitments; OpenAI, for example, says it uses data from versions of ChatGPT for individuals to train its models. CIO Support's AI acceptable-use policy template says personal AI accounts are not used for company work, so point the requester to an approved business tool. A free plan that gives the company its own managed accounts is a different case: vet it like any other plan.

Who should do the vetting in a small business?

Whoever owns IT or operations can usually gather the answers from the vendor's public pages and plan table. The decision belongs to a named business owner, and tools that will touch Confidential or Restricted data should be approved by a senior leader.

Need help with this?

LAN Service Group helps small and mid-size businesses vet AI tools before staff use them, from reading vendor terms and plan tables to setting up company accounts, SSO and an approved-tools register, as a fractional CIO or as their managed IT provider, fully outsourced or co-managed alongside in-house IT staff.

Talk to LAN Service Group LAN Service Group AI services → (888) 281-7243